Connecting the dots between recently active cryptominers
Summary: Cisco Talos reported that illicit cryptocurrency mining campaigns it had initially mistaken for a single actor were traced through wallet and command-and-control analysis to several groups, including Rocke, the 8220 Mining Group and an actor it named tor2mine, which shared tools and techniques. Rocke exploited Apache Struts2 servers in spring and summer 2018 and later Jenkins and JBoss servers, while the 8220 Mining Group amassed nearly $200,000 worth of Monero and combined the groups made hundreds of thousands of dollars in profits.
Key Takeaway: Rocke has been developing destructive malware disguised as ransomware and expanding into worm-like payloads, so an actor whose tooling is copied freely across groups may deliver something worse than a miner, and Talos notes activity tapered off only after Alibaba took down Rocke infrastructure on its cloud.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026